Will It Vibe?Cookie SameSite set to 'none'
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A cookie is set with sameSite: 'none', so it is attached to cross-site requests; without a strong reason this widens CSRF exposure.
Why it matters
A cookie set with sameSite: 'none' is sent on cross-site requests, which reopens the door to CSRF that SameSite normally closes. It is sometimes needed for cross-site embeds, but it is often set by copy-paste without that requirement, widening the attack surface. SameSite None also requires the Secure flag to be accepted by browsers.
How to fix it
Use sameSite: 'lax' (a good default) or 'strict' unless the cookie truly must travel cross-site. When None is genuinely required, always pair it with Secure and back the endpoints with anti-CSRF tokens. Review whether the cross-site scenario still applies before keeping None.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo